Let's talk
Legal

Privacy Policy

What we collect, why, and how we look after it. Short version: as little as possible, and never sold.

Last updated 22 October 2026Acroative Designs · Mark James

01Who we are

Acroative Designs is the independent studio of Mark James, based in Malaysia and working with clients worldwide. We are responsible for the personal data described in this policy. You can reach us at hey@acroative.com.

02What we collect

We keep it to the minimum:

  • When you contact us or book a call: your name, email address, and anything you choose to share in your message, booking notes or on a call.
  • When we work together: billing details, project information and access to the accounts and tools the work needs.
  • When you visit the site: our hosting provider keeps standard server logs, such as IP address, browser type and the pages requested, for security and performance.
  • How the site is used: Google Analytics records the pages you view, how long you stay, your approximate location (country and city), your device and browser, and actions such as opening the booking form. It uses cookies to tell visits apart and does not show us who you are.

Cookies and your choice. Analytics cookies are the only cookies on this site, and we never use advertising cookies. If you visit from the UK, EU or EEA, analytics stays off until you allow it. Anyone can change their choice at any time with Cookie settings at the bottom of every page. The site also stores two small values in your browser: one in session storage so page transitions play the right way, and your cookie choice, if you make one.

03How we use it

  • To reply to your enquiry and prepare a proposal
  • To deliver and support your project
  • To send invoices and keep business and tax records
  • To keep the website secure and running smoothly

We do not use your data for automated decisions, and we will only send you marketing emails if you have asked for them.

04Legal basis

We handle personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA). For clients and visitors in the UK and EU, we rely on the GDPR’s lawful bases: taking steps towards or performing a contract, our legitimate interest in running and securing the business, meeting legal obligations, and your consent where we ask for it.

05Who we share it with

We never sell your data. We only share it with trusted services that help us run the business, and only as much as they need:

  • Hosting: Hostinger, which hosts this website and its server logs
  • Analytics: Google Analytics, which measures how the site is used, as described above. Google’s use of this data is covered by its own policy
  • Bookings: Google Calendar and Google Meet, when you book a call. The booking form sends your name, email and any notes you add to our Google account, which creates the meeting and emails you an invite
  • Email and documents: the providers we use for email, file sharing and invoicing
  • Fonts: some case study pages load a client’s brand fonts from Google Fonts, which receives your IP address to deliver them
  • Project tools: the platforms used to build your project, with your agreement
  • The law: authorities, when we are legally required to

06International transfers

Some of these services store data outside Malaysia, including in the United States and Europe. When that happens, we choose providers with recognised safeguards in place to protect your data.

07How long we keep it

We keep enquiry emails for up to two years if no project follows, and project and billing records for seven years to meet tax and accounting rules. Server logs are kept by our host for a short period. Google Analytics keeps detailed visit data for two months and visitor-level data for up to 14 months; reports use totals only. After that, data is deleted or anonymised.

08Security

We protect your data with strong passwords, two-factor authentication, encrypted connections and access limited to what each task needs. Logins you share for a project are stored securely and removed when the project ends. No system is completely secure, but we take reasonable steps to keep your information safe.

09Your rights

You can ask us to:

  • Show you the personal data we hold about you
  • Correct anything that is wrong or out of date
  • Delete your data, where we no longer need to keep it
  • Stop or limit how we use it, or withdraw consent
  • Send your data to you or another provider

Email hey@acroative.com and we will reply within 21 days. You also have the right to complain to your local data protection authority, such as Malaysia’s Personal Data Protection Department.

10Children

Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18.

11Changes to this policy

We may update this policy as the business or the law changes. The date at the top of this page shows the latest version. Significant changes will be highlighted here.